How to use simple roles for authorization in application?

Thanks. I mixed two different things, Identity and Permissions. Now i know that Identity has no idea about Permissions, and roles inheritance works only with Permissions.

So how i resolve my task? There is two possibilities.

Simple way (but maybe not the right way :-)

i changed enum column to set, for specify more roles for user. And update code for new Identity

<?php
...
$arr = $row->toArray();
unset($arr['password']);
return new Nette\Security\Identity($row->id, explode(',',$row->role), $arr);
...
?>

now i have in db (db row: username => chemix, role => "admin,user,photograph,writer,supervisor,adsmanager")

i removed authorizator section from config

and dump is

<?php
class DashboardPresenter extends BasePresenter {

	public function renderDefault()
	{
		dump($this->user->getRoles());
		echo '-';
		dump($this->user->isInRole('root'));
		dump($this->user->isInRole('admin'));
		dump($this->user->isInRole('adsmanager'));
		dump($this->user->isInRole('supervisor'));
		dump($this->user->isInRole('writer'));
		dump($this->user->isInRole('photograph'));
		dump($this->user->isInRole('user'));

	}
}
?>

array (6)
0 => "admin" (5)
1 => "adsmanager" (10)
2 => "supervisor" (10)
3 => "writer" (6)
4 => "photograph" (10)
5 => "user" (4)
-
FALSE
TRUE
TRUE
TRUE
TRUE
TRUE
TRUE

it's work :) maybe dirty way, but works

second way is

Use Permissions (better, but not harder ;-)

database scheme

CREATE TABLE `users` (
  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `username` varchar(255) NOT NULL,
  `salt` char(32) NOT NULL,
  `password` char(64) NOT NULL,
  `email` varchar(255) NOT NULL,
  `role` enum('root','admin','adsmanager','supervisor','writer','photograph','user') NOT NULL DEFAULT 'user',
  PRIMARY KEY (`id`),
  UNIQUE KEY `username` (`username`),
  UNIQUE KEY `email` (`email`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

config.neon

	services:
		authenticator: Authenticator
		authorizator:
			class: Nette\Security\Permission
			setup:
				- addRole('user')
				- addRole('photograph', 'user')
				- addRole('writer', 'photograph')
				- addRole('supervisor', 'writer')
				- addRole('adsmanager', 'supervisor')
				- addRole('admin', 'adsmanager')
				- addRole('root', 'admin')
				- addResource('Ads')
				- addResource('Photos')
				- addResource('Articles')
				- addResource('Users')
				- allow('adsmanager', 'Ads', 'view')
				- allow('adsmanager', 'Ads', 'add')
				- allow('adsmanager', 'Ads', 'edit')
				- allow('photograph', 'Photos', 'add')
				- allow('writer', 'Articles', 'view')
				- allow('writer', 'Articles', 'add')
				- allow('supervisor', 'Articles', 'publish')
				- allow('admin', 'Users', 'view')
				- allow('admin', 'Users', 'add')

Authenticator

<?php
...
$arr = $row->toArray();
unset($arr['password']);
return new Nette\Security\Identity($row->id, $row->role, $arr);
...
?>

and tests

<?php
class DashboardPresenter extends BasePresenter {

	public function renderDefault()
	{
		dump($this->user->isAllowed('Photos', 'add'));
		dump($this->user->isAllowed('Articles', 'publish'));
		dump($this->user->isAllowed('Ads', 'view'));
		dump($this->user->isAllowed('Ads', 'add'));
		dump($this->user->isAllowed('Users', 'add'));

	}
}
?>

returns for user = chemix with role = adsmanager

TRUE
TRUE
TRUE
TRUE
FALSE

wow, amazing :) the inherittence works perfect, and it's more powerful and open for future that only asking for a user role.

Once again thanks to enumag and his help on jabber and his comment https://forum.nette.org/…-permissions#…